Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/lzehrung/codegraph/agents-mdgit clone --depth 1 https://github.com/lzehrung/codegraphWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01919 | $0.01919 |
| Opus 5 | $0.00959 | $0.00959 |
| Sonnet 5 | $0.00384 | $0.00384 |
| Haiku 4.5 | $0.00192 | $0.00192 |
Grade A, and why
codegraph AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENT DIRECTIVES
General
- Never use
anyoras unknown as - Never use nested ternary expressions. Use
if/else, a helper function, or named intermediate values instead. - Never use
=== true,=== false, etc. in boolean conditions; keep them as terse and simple as possible like!condition. Extract conditions to variables when the variable name adds clarity/insight into the reason for the condition. - In boolean condition contexts, use the shortest syntactically equivalent expression. Prefer
items.lengthoveritems.length > 0,!items.lengthoveritems.length === 0, anditems?.lengthoveritems && items.length > 0. - Always consider the impact of a change on tests or when more test cases are needed. Never make tests pass for the sake of passing; always exercise real behavior.
- Always keep documentation updated and accurate while being minimal and concise.
- Keep paragraphs to no more than 4 concise sentences. Prefer bullets for dense details.
- Keep
README.mdas the landing page and docs index. Do not turn it back into the only canonical reference for every example and workflow. - When public-facing install, runtime, CLI, library API, MCP, agent workflow, or release guidance changes, update the relevant canonical docs in the same change:
README.md,docs/installation.md,docs/cli.md,docs/library-api.md,docs/mcp.md,docs/agent-workflows.md,docs/how-it-works.md, andPUBLISHING.mdas applicable. - For repo-understanding flows, start with
node ./dist/cli.js doctorandnode ./dist/cli.js orient --root . --budget small --jsonwhendistis built; build first if validating the working tree from a fresh checkout. - For source-checkout validation and contributor examples, prefer
node ./dist/cli.js ...; reserve barecodegraph ...for published/global install guidance. - When package metadata, install scripts, optional native dependencies, or the resolved npm graph changes, update
package-lock.jsonin the same change and verify withnpm ci --ignore-scripts --dry-rununless lifecycle scripts are part of the behavior under test. Release-candidate package installs MUST also disable lifecycle scripts unless those scripts are under test. - Treat
--rootas the project boundary for config lookup, path confinement, and output normalization. Cache/manifests may use the resolved cache anchor (--cache-dir/CODEGRAPH_CACHE_DIR, repository metadata, or project root); cached contents remain project-relative. - Keep discovery glob guidance accurate:
codegraph.config.jsonglobs are project-root-relative, while CLI--include-glob/--ignore-globvalues are one-off filters relative to each active scan root. - Within any claimed cross-language capability, behavior should stay consistent across all supported languages for that capability. Avoid language-subset branches; if a limitation is intentional, document it in the parity docs and cover it with explicit tests in the same change.
- When language support changes, update
docs/language-parity.mdanddocs/scenario-catalog.mdin the same change so support claims, limitations, and fixture coverage stay aligned. - When adding or changing a cross-file language scenario, add or update the nearest language test in
tests/languages/*.test.tsand the shared semantic coverage intests/goto.test.ts,tests/references.test.ts, andtests/native-semantic-parity.test.tswhen the language uses the native runtime. - Always keep the README.md table of contents updated whenever README sections are added, removed, or renamed.
- Human-readable CLI output is a public contract. User-facing
writeCliOutput(...)callsites must provide a command-specific formatter unless the output is intentionally scalar or JSON-first, and the same change should add or update a pretty-output test. - Progress MUST identify the active operation. Show a count only when it is meaningful; do not report zero progress for work with no measurable total.
- When CLI commands, flags, or output contracts change, update both
docs/cli.mdandcodegraph-skill/codegraph/SKILL.mdin the same change. - Always keep
codegraph-skill/codegraph/SKILL.mdupdated when CLI commands, flags, or capabilities change. This file is the skill definition used by agents and must reflect the current tool surface. - Documentation and tool descriptions MUST name the exact CLI command, MCP tool, or exported API. Do not replace it with vague nouns such as "orientation", "navigation", or "targeted search".
- Describe aggregate operations precisely: name the first-pass retrieval and derived context, and state when planning, subquery decomposition, or runtime proof is absent. Do not describe parser/backend quality as query reasoning.
- Recommend direct primitives before bounded aggregators. Do not label an aggregate tool as the first step when exact symbol, reference, call, or file-dependency tools apply.
- Keep each surface role-specific: help and tool descriptions give the selection rule; CLI/API docs give the contract; skills give command order. Avoid repeating tutorials across surfaces.
- Distinguish library/session-only features from CLI/config features explicitly. If a capability exists only in exported library APIs, docs and types must say so, and CLI/config surfaces must not imply support they do not implement.
- When changing MCP notification, transport, or progress behavior, verify both the protocol seam and the serving seam users actually hit (HTTP/stdio); do not assume protocol-level behavior survives a transport wrapper unchanged.
- Before major commits or concluding work, run
npm run checkto verify formatting, lint, build, and tests together. During iteration, use the narrowest meaningful test command: targeted Vitest suites for localized changes,npm run test:fastfor broader TypeScript changes,npm run test:integrationfor CLI/report/output contracts, andnpm run test:nativewhen touchingpackages/codegraph-native. - Installation guidance must use
@lzehrung/codegraphand the@lzehrungGitHub Packages registry. Keep detailed install docs indocs/installation.md. - Any persistent storage schema change (e.g. SQLite tables/columns/indexes) MUST include a migration path for existing on-disk data. If using
CREATE TABLE IF NOT EXISTS, you must alsoALTER TABLE/ backfill as needed (or introduce explicit schema versioning) and add a regression test that starts from an older schema to prove upgrades work. - DO NOT use curly quote variants or other non-standard characters humans would not type with a standard QWERTY keyboard.
- Duplicate-tokenizer fingerprints must not shift with the toolchain. The TypeScript and native
identifier grammars are pinned to one Unicode version: the native side through the exact
unicode-identpin inpackages/codegraph-native/Cargo.toml, the TypeScript side through the generatedsrc/duplicate-identifier-ranges.ts. Never resolve that grammar with a Unicode property escape, which follows the host Node build's Unicode version. Changing the crate pin means rerunningnpm run generate:duplicate-identifier-rangesand bumpingDUPLICATE_TOKENIZER_REVISIONin the same change, so cached duplicate units tokenized by the previous grammar are recomputed instead of survivingDUPLICATE_UNIT_CACHE_MAX_AGE_MS. packages/codegraph-native/Cargo.lockis committed because the crate ships prebuilt binaries. Update it in the same change as anyCargo.tomldependency edit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 69 lines · 1,919 tokens per session scan A 4fac441d4c2e
codegraph AGENTS.md is an instructions file published in the GitHub repository lzehrung/codegraph (4 stars, last pushed yesterday), licensed MIT. It adds 1,919 tokens to every session, about $0.0096 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
astra-code-map AGENTS.md
Instructions for SourceAstra/astra-code-map, covering repository guidelines, 项目结构, 构建、测试与开发, 代码风格与命名 and 测试指南.
mirage CLAUDE.md
Instructions for strukto-ai/mirage, covering claude.md, repo layout, typescript packages, python/typescript parity and module layout.
mcp-steroid CLAUDE.md
Instructions for jonnyzzz/mcp-steroid, covering claude.md, agents.md, design philosophy, recursive context lookup (do this before sub-folder work), sub-folder guides and must do.
TakoVM CLAUDE.md
Instructions for Tako-Research/TakoVM, covering tako vm, why gvisor?, architecture, key concepts and build & test.
tree-sitter-analyzer CLAUDE.md
Instructions for aimasteracc/tree-sitter-analyzer, covering ruflo — claude code configuration, rules, test quality rules — locked (2026-06-28), t-1: no new test files for existing plugins (blocker) and t-2: no weak assertions — ratchet-enforced (blocker).
tree-sitter-fsharp AGENTS.md
Instructions for ionide/tree-sitter-fsharp, covering improving the f# tree-sitter parser, project structure, running the cli, workflow for adding a new feature and 1. create a test case first.